CVE-2021-23440
📋 TL;DR
CVE-2021-23440 is a type confusion vulnerability in the set-value npm package that allows attackers to bypass previous security fixes (CVE-2019-10747) when user-provided keys in path parameters are arrays. This can lead to prototype pollution attacks. Affected are applications using vulnerable versions of set-value directly or as a dependency.
💻 Affected Systems
- set-value npm package
📦 What is this software?
Communications Cloud Native Core Policy by Oracle
View all CVEs affecting Communications Cloud Native Core Policy →
Set Value by Set Value Project
Set Value by Set Value Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution or complete system compromise through prototype pollution leading to arbitrary code execution in Node.js applications.
Likely Case
Application instability, denial of service, or limited data manipulation through prototype pollution.
If Mitigated
Minimal impact if input validation and sanitization are properly implemented.
🎯 Exploit Status
Proof-of-concept code is available in public references. Exploitation requires user-controlled input to vulnerable functions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: set-value >=2.0.1, >=4.0.1
Vendor Advisory: https://github.com/jonschlinkert/set-value/security/advisories
Restart Required: Yes
Instructions:
1. Update package.json to use set-value >=2.0.1 (for v2) or >=4.0.1 (for v3/v4). 2. Run 'npm update set-value' or 'yarn upgrade set-value'. 3. Restart the application.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation to ensure path parameters are not arrays before passing to set-value functions.
🧯 If You Can't Patch
- Implement strict input validation to reject array keys in path parameters
- Use alternative libraries like lodash.set or dot-prop with proper security configurations
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for set-value version. Run 'npm list set-value' or check node_modules/set-value/package.json.Check Version:
npm list set-value | grep set-valueVerify Fix Applied:
Verify set-value version is >=2.0.1 (if using v2) or >=4.0.1 (if using v3/v4) after update.📡 Detection & Monitoring
Log Indicators:
- Unusual application crashes, unexpected prototype modifications, or errors from set-value functions
Network Indicators:
- Unusual HTTP requests with array-like parameters to endpoints using set-value
SIEM Query:
Search for application logs containing 'set-value' errors or prototype pollution indicators🔗 References
- https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452
- https://github.com/jonschlinkert/set-value/pull/33
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212
- https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541
- https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452
- https://github.com/jonschlinkert/set-value/pull/33
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212
- https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541
- https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/
- https://www.oracle.com/security-alerts/cpujan2022.html
